Anthropic recently announced it has expanded its Cyber Verification Program, which makes advanced cybersecurity capabilities and reduced blocking classifiers available to qualifying security professionals. The program now features three access tiers:
- Defense Access covers SOC, incident response, malware reverse-engineering, and vulnerability validation.
- Red Team Access adds authorized penetration testing.
- Specialized Access tests power grids, flight systems, telecom networks, and the interbank transfer infrastructure.
The Specialized Access tier is reserved only for organizations cleared by the U.S. government, working in collaboration with Anthropic. All three tiers include access to Claude AI models—including Opus, Sonnet, and Mythos. Users will also receive access to new models that emerge.
“The tiered model from Anthropic recognizes something security people already understand—that capability should be proportional to trust, use-case, and blast radius,” says Aviv Nahum, Co-founder and CEO at Above Security. “The answer is not one universal set of restrictions for everyone.”
AI Vendors Now Acting as Credentialing Authorities
The more consequential detail of this expansion sits within the Anthropic test data. On a benchmark of multi-stage cyber operations, the Red Team Access tier performed the same as a model with no safeguards at all.
This means the protection at that level is the vetting process rather than the model’s refusals. That makes an AI vendor a de facto licensing body for offensive capabilities—with data retention, proof of security controls, and government review as the terms of entry.
For security leaders, the key questions to answer include which tier their scope of work justifies, what they give up to get that tier, and whether their teams can fix flaws as quickly as these models find them.
Expanding on these challenges, Diana Kelley, Chief Information Security Officer at Noma Security, comments, “We shouldn’t have to wait for an attack before a vulnerability is worth fixing. However, a large CVE count isn’t proof of value either. Risk depends on how likely exploitation is in that environment, the business impact if it happens, and whether compensating controls reduce the likelihood or consequences. A valid finding on an exposed critical system is different from one behind effective isolation. The useful measure is how much risk the team can reduce, not just how many vulnerabilities the AI finds.”
Closing Unlocked Doors Before Threat Actors Arrive
The three-tier expansion merges the Anthropic Cyber Verification Program with Project Glasswing. Announced this past April, Glasswing brought together Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks to help Anthropic secure critical software.
The group launched this project after observing capabilities in a frontier model trained by Anthropic that revealed a stark fact. AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.
The verified vulnerabilities found by Anthropic and its partners during Project Glasswing (from April to July) totaled nearly 135K. Of those, more than 33K were rated as critical or high, with partners reporting that discovery had been accelerated by months or even years.
“Recent research showed only 3 out of 300 CVEs discovered by Project Glasswing were exploited,” notes John Gallagher, Vice President at Viakoo. “However, a 1% exploitation rate isn’t a sign of failure—it’s proof that proactive defense is working as intended. In enterprise IT, finding unexploited vulnerabilities is helpful; in OT/IoT and critical infrastructure, finding them before they become weaponized is critically important. Getting early visibility into obscure OT/IoT vulnerabilities gives defenders the lead time needed to close doors before threat actors even realize they’re unlocked.”
Testing the Efficacy of Each Tier
To assess the efficacy of the CVP protections, Anthropic ran Claude Opus through CyScenarioBench—an evaluation that measures whether models can plan and execute multi-stage cyber operations under realistic constraints.
With safeguards tuned for the different CVP tiers, Anthropic ran five attempts at each of the 10 CyScenarioBench challenges, generating these results:
- Without CVP access, every task was blocked on the first prompt.
- In the Defense Access tier, 46 of the 50 trials were blocked at some point in the challenge while the remaining four tasks succeeded.
- In the Red Team Access tier, no blocks occurred, and Claude Opus successfully completed 34 of the 50 tasks—effectively equivalent to the model’s 67.6% success rate on this evaluation with no safeguards applied (representative of Specialized Access).
These evaluations give Anthropic the confidence that it can make advanced cyber capabilities safely available to a broader set of defenders, expanding the defensive efforts begun with Project Glasswing.
Key Consideration for Security Leaders
Data retention is required for organizations enrolled in the CVP program so Anthropic can monitor for cyber misuse. Once Enterprise Frontier Safeguards (EFS)—which combines the privacy of zero data retention with robust safeguards—is available later this fall, organizations can store data in cloud infrastructure they control. Until EFS is available, organizations with access to Claude Fable or Claude Mythos with zero data retention can also use CVP with zero data retention.
As security leaders interact with the Anthropic Cyber Verification Program, it’s important to match the access tier to their actual scope of work. Leaders must also account for retention and control requirements up front while patching data undisclosed by Glasswing partners.
“Defense Access is the tier that most helps human analysts,” says Ram Varadarajan, CEO at Acalvio. “It takes on the SOC triage, malware reverse engineering, and vulnerability validation work that buries people while leaving judgment and accountability with them. A low exploitation rate shows that finding vulnerabilities was never the real bottleneck. Knowing which ones matter and stopping the ones that do is, and that's where AI-speed discovery must be paired with architectural defenses rather than treated as a finish line.”
Adds Amir Boldo, Co-Founder and Chief Product and Technology Officer at Above Security, “Access is the right model because it treats capability as something you keep earning, not something you're granted once. For defenders, the real value isn't model writing exploits. It's compressing the hours an analyst spends reconstructing what happened, why it happened, and whether it's actually risky. That's where we see the most leverage: the AI correlates activity across identity, SaaS, and endpoints, and the human investigator makes the call. As these capabilities spread, the control question must move from 'who is allowed to use the model' to 'what is this identity actually doing with it.' Mandatory retention and real-time blocks on high-risk actions are a good start on Anthropic's side. Every enterprise rolling out AI internally needs that same behavioral visibility on theirs.”
